CVE-2021-22893

Опубликовано: 23 апр. 2021

Источник: nvd

CVSS3: 10

CVSS2: 7.5

EPSS Критический

Описание

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.

Ссылки

https://blog.pulsesecure.net/pulse-connect-secure-security-update/
Vendor Advisory
https://kb.cert.org/vuls/id/213092
Third Party Advisory
US Government Resource
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/
Broken Link
Vendor Advisory
https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html
Third Party Advisory
https://blog.pulsesecure.net/pulse-connect-secure-security-update/
Vendor Advisory
https://kb.cert.org/vuls/id/213092
Third Party Advisory
US Government Resource
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/
Broken Link
Vendor Advisory
https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html
Third Party Advisory
https://www.kb.cert.org/vuls/id/213092
US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22893
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r3.5:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r4:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r4.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r5.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.0:r6.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*

cpe:2.3:a:ivanti:connect_secure:9.1:r9.2:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.93485

Критический

10 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-287

CWE-416

Связанные уязвимости

GHSA-hcxw-prp6-q3jq

CVSS3: 10

github

больше 3 лет назад

BDU:2021-02329

CVSS3: 10

fstec

почти 5 лет назад

Уязвимость VPN-шлюза корпоративных сетей Pulse Connect Secure, связанная с ошибками аутентификации, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 100%

0.93485

Критический

10 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-287

CWE-416